1

I get the following error when trying the connection to github:

curl -vLk https://api.github.com/rate_limit
*   Trying 140.82.121.6:443...
* Connected to api.github.com (140.82.121.6) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* error:1408F10B:SSL routines:ssl3_get_record:wrong version number
* Closing connection 0
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number

This is on a raspberry pi running rasbian bullseye.

On my other client on the same network, running Ubuntu 22.04, everything works fine.

I do believe that the openssl version is good enough:

python -c 'import ssl; print(ssl.OPENSSL_VERSION)'
OpenSSL 1.1.1n  15 Mar 2022

Any ideas how to fix the issue?

Improve this question
5
  • 1
    Can you please show output of curl --version ?
    – zomega
    Nov 25, 2022 at 12:00
  • The openssl version shown in Python might be unrelated to the one from curl. In fact, curl might not even use openssl but any of the various other TLS backends it supports. As suggested, use curl --version to get the exact details of what curl is using.
    – Steffen Ullrich
    Nov 25, 2022 at 12:22
  • Here you go: curl --version curl 7.74.0 (arm-unknown-linux-gnueabihf) libcurl/7.74.0 OpenSSL/1.1.1n zlib/1.2.11 brotli/1.0.9 libidn2/2.3.0 libpsl/0.21.0 (+libidn2/2.3.0) libssh2/1.9.0 nghttp2/1.43.0 librtmp/2.3 Release-Date: 2020-12-09 Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps mqtt pop3 pop3s rtmp rtsp scp sftp smb smbs smtp smtps telnet tftp Features: alt-svc AsynchDNS brotli GSS-API HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM NTLM_WB PSL SPNEGO SSL TLS-SRP UnixSockets
    – Robert
    Nov 25, 2022 at 12:31
  • I'm actually seeing the same issue from another application. I just thought that it would be easier to investigate since I can recreate it with curl.
    – Robert
    Nov 25, 2022 at 12:33
  • There are no proxies.
    – Robert
    Nov 25, 2022 at 12:39

1 Answer 1

Reset to default
7 
curl -vLk https://api.github.com/rate_limit
...
* Connected to api.github.com (140.82.121.6) port 443 (#0)

The IP address is correct.

...
* TLSv1.3 (OUT), TLS handshake, Client hello (1):

This means a recent TLS stack is used which supports TLS 1.3. The output is typical to an OpenSSL backend of curl. Looks good so far.

* error:1408F10B:SSL routines:ssl3_get_record:wrong version number

This error message is in most cases misleading. I suspect that there is something in your network which intercepts traffic and replies with a non-TLS answer, which then gets interpreted as TLS and thus an unexpected TLS version is found in the (non-TLS) reply.

The typical reasons for this are wrong proxy configuration, captive portals or similar in the network or firewalls blocking connections. Unfortunately nothing is known about the environment where you run this rasperry pi on, so it is hard to give more precise reasons. In any case the problem is very likely outside of your machine.

Edit: the provided packet capture reflects what I expected:

wireshark display of packet capture

It can be seen that the reply to the TLS Client Hello is the following plain HTTP response:

HTTP/1.1 200 OK
Server: Jetty/4.2.x (Windows XP/5.1 x86 java/1.6.0_17)
Content-Type: text/html
Content-Length: 186
Accept-Ranges: bytes

<html>
<head>
<meta HTTP-EQUIV="REFRESH" content="0; url=http://192.168.68.1:80/shn_blocking.html?cat_id=56&mac=B827EBDA723E&domain=api.github.com">
</head>
<body></body>
</html>

This is a refresh based redirect to (probably) the router with a path of /shn_blocking.html. Searching for this path on the internet suggest that this is a feature of some TP-Link router which can block web sites for parental control - see here about this feature of your specific router TP-Link Deco . Likely that you need to specifically exclude your rasperry pi in the router so that it gets unfiltered internet access.

Improve this answer
6
  • Thanks for the details. It might very well be outside of my machine, but I find it confusing that it works from my other machine, connected to the same network. I'd be happy to share any details about the environment, that you may need to understand the problem.
    – Robert
    Nov 25, 2022 at 12:38
  • 2
    @Robert: "... it works from my other machine, connected to the same network. I'd be happy to share any details about the environment," - is this a home network or some company network? Do you have control over the network router/firewall and can see if there are special settings either for the working machine or for the non-working? Could you provide a packet capture from a failed connection on the rasperry pi, i.e. tcpdump -i any -s0 -w 443.pcap port 443 and provide the file 443.pcap, so that one can see what is actually inside the server reply?
    – Steffen Ullrich
    Nov 25, 2022 at 12:55
  • Is this one accessible for you? github.com/Klurige/shared/blob/master/443.pcap
    – Robert
    Nov 25, 2022 at 13:26
  • This is a home network. The firewall in question is included by my router, which is a TPLink Deco X20. A fancy router, but with very limited possibilites if you want to do anything a bit more advanced. There are no specific settings for any of these clients.
    – Robert
    Nov 25, 2022 at 13:31
  • 1
    @Robert: looks like its parental control of your router blocking access. See updated answer.
    – Steffen Ullrich
    Nov 25, 2022 at 13:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .